Methods for client certificate delegation and devices thereof

Abstract

Methods, non-transitory computer readable media, and network traffic management apparatuses that receive a request from a client device to access an application. The request comprises an original certificate. A determination is made when the certificate is valid. Data is extracted from one or more fields of the certificate, when the determining indicates that the user certificate is valid. A delegate certificate comprising the data and signed by a certificate authority trusted by a server device hosting the application is generated. The delegate certificate is sent to the server device. With this technology, network traffic management apparatuses can secure SSL connections using PFS-capable ciphers, while also inspecting payload data in network traffic exchanged between client and server devices in order to provide intelligent services in the network.

What is claimed is: 
     
       1. A method for client certificate delegation implemented by a network traffic management system comprising one or more network traffic management apparatuses, server devices, or client devices, the method comprising:
 receiving a request from a client to access an application identified in the request and hosted by a server, the request including an identifying certificate; 
 executing one or more instructions stored in non-transitory memory that results in one or more actions being performed involving the identifying certificate to generate a delegate certificate, the actions comprising:
 extracting data from one or more fields of the identifying certificate when the identifying certificate is valid, 
 inserting at least a portion of the extracted data into the delegate certificate, 
 annotating the delegate certificate to include an indication of the application hosted by the server and identified in the request received from the client, and 
 signing the delegate certificate using a certificate authority that is trusted by the server hosting the application identified in the request; and 
 
 sending the delegate certificate to the server along with the request received from the client. 
 
     
     
       2. The method of  claim 1 , further comprising:
 receiving an indication from the server that the delegate certificate was successfully validated by the server; and 
 sending another indication to the client that the delegate certificate was successfully validated. 
 
     
     
       3. The method of  claim 1 , further comprising generating the delegate certificate to have an established lifetime. 
     
     
       4. The method of  claim 1 , wherein the annotating further comprises inserting the indication of the application into a Service Principle Name (SPN) extension of the delegate certificate. 
     
     
       5. The method of  claim 1 , further comprising:
 decrypting one or more communications encrypted using Perfect Forward Secrecy (PFS) encryption and received from the client; and 
 encrypting another one or more communications to be sent to the server using PFS encryption. 
 
     
     
       6. The method of  claim 1 , wherein the certificate authority is a trusted issuer certificate authority that signed the identifying certificate or a local delegate certificate authority having a trust relationship with the trusted issuer certificate authority. 
     
     
       7. A network traffic management apparatus, comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
 receive a request from a client to access an application identified in the request and hosted by a server, the request including an identifying certificate; 
 perform one or more actions involving the identifying certificate to generate a delegate certificate, the actions comprising:
 extracting data from one or more fields of the identifying certificate when the identifying certificate is valid, 
 inserting at least a portion of the extracted data into the delegate certificate, 
 annotating the delegate certificate to include an indication of the application hosted by the server and identified in the request received from the client, and 
 signing the delegate certificate using a certificate authority that is trusted by the server hosting the application identified in the request; and 
 
 send the delegate certificate to the server along with the request received from the client. 
 
     
     
       8. The network traffic management apparatus of  claim 7 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions stored to:
 receive an indication from the server that the delegate certificate was successfully validated by the server; and 
 send another indication to the client that the delegate certificate was successfully validated. 
 
     
     
       9. The network traffic management apparatus of  claim 7 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions stored to generate the delegate certificate to have an established lifetime. 
     
     
       10. The network traffic management apparatus of  claim 7 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions stored to insert the indication of the application into a Service Principle Name (SPN) extension of the delegate certificate. 
     
     
       11. The network traffic management apparatus of  claim 7 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions stored to:
 decrypt one or more communications encrypted using Perfect Forward Secrecy (PFS) encryption and received from the client; and 
 encrypt another one or more communications to be sent to the server using PFS encryption. 
 
     
     
       12. The network traffic management apparatus of  claim 7 , wherein the certificate authority is a trusted issuer certificate authority that signed the identifying certificate or a local delegate certificate authority having a trust relationship with the trusted issuer certificate authority. 
     
     
       13. A non-transitory computer readable medium having stored thereon instructions for client certificate delegation comprising executable code which when executed by one or more processors, causes the processors to:
 receive a request from a client to access an application identified in the request and hosted by a server, the request including an identifying certificate; 
 perform one or more actions involving the identifying certificate to generate a delegate certificate, the actions comprising:
 extracting data from one or more fields of the identifying certificate when the identifying certificate is valid, 
 insert at least a portion of the extracted data into the delegate certificate, 
 annotate the delegate certificate to include an indication of the application hosted by the server and identified in the request received from the client, and 
 sign the delegate certificate using a certificate authority that is trusted by the server hosting the application identified in the request; and 
 
 send the delegate certificate to the server along with the request received from the client. 
 
     
     
       14. The non-transitory computer readable medium of  claim 13 , wherein the executable code when executed by the processors further causes the processor to:
 receive an indication from the server that the delegate certificate was successfully validated by the server; and 
 send another indication to the client that the delegate certificate was successfully validated. 
 
     
     
       15. The non-transitory computer readable medium of  claim 13 , wherein the executable code when executed by the processors further causes the processor to generate the delegate certificate to have an established lifetime. 
     
     
       16. The non-transitory computer readable medium of  claim 13 , wherein the executable code when executed by the processors further causes the processor to insert the indication of the application into a Service Principle Name (SPN) extension of the delegate certificate. 
     
     
       17. The non-transitory computer readable medium of  claim 13 , wherein the executable code when executed by the processors further causes the processor to:
 decrypt one or more communications encrypted using Perfect Forward Secrecy (PFS) encryption and received from the client; and 
 encrypt another one or more communications to be sent to the server using PFS encryption. 
 
     
     
       18. The non-transitory computer readable medium of  claim 13 , wherein the certificate authority is a trusted issuer certificate authority that signed the identifying certificate or a local delegate certificate authority having a trust relationship with the trusted issuer certificate authority. 
     
     
       19. A network traffic management system comprising one or more network traffic management apparatuses, server devices, or client devices, the network traffic management system comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
 receive a request from a client to access an application identified in the request, the request comprising an identifying certificate; 
 determine when the identifying certificate is valid and extracting data from one or more fields of the identifying certificate, when the determining indicates that the identifying certificate is valid; 
 generate a delegate certificate comprising the data and signed by a certificate authority trusted by a server hosting the application; 
 annotate, prior to communicating with the server, the delegate certificate to include the indication of the application identified in the access request received from the client; and 
 send the delegate certificate to the server. 
 
     
     
       20. The network traffic management system of  claim 19 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to:
 receive an indication from the server that the delegate certificate was successfully validated by the server; and 
 send another indication to the client that the delegate certificate was successfully validated. 
 
     
     
       21. The network traffic management system of  claim 19 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to generate the delegate certificate to have an established lifetime. 
     
     
       22. The network traffic management system of  claim 19 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to insert the indication of the application into a Service Principle Name (SPN) extension of the delegate certificate. 
     
     
       23. The network traffic management system of  claim 19 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to:
 decrypt one or more communications encrypted using Perfect Forward Secrecy (PFS) encryption and received from the client; and 
 encrypt another one or more communications to be sent to the server using PFS encryption. 
 
     
     
       24. The network traffic management system of  claim 19 , wherein the certificate authority is a trusted issuer certificate authority that signed the identifying certificate or a local delegate certificate authority having a trust relationship with the trusted issuer certificate authority.